httd
httd is a Go-based Linux implant identified within an exposed Roundcube exploitation toolkit environment dubbed Roundish. It was found in an exfiltrated archive from blog.pentagonteam[.]com, and the recovered toolkit was assessed with medium-high confidence to align with APT28 (Fancy Bear/Sednit), a Russia GRU-attributed threat actor, based on multiple technical overlaps with Operation RoundPress. The implant is described as providing persistence on Linux systems via cron, systemd, and SELinux policy manipulation. The broader Roundish toolkit targeted webmail, especially Roundcube, for credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and extraction of 2FA/TOTP secrets, with confirmed targeting of mail.dmsu.gov.ua, the Ukrainian State Migration Service Roundcube instance. A reported sample hash for httd is SHA-256 e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A Go-based Linux implant (httd) found in a compromised environment provides persistence via cron, systemd, and SELinux.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Go-based Linux implant that provides persistence through cron, systemd, and SELinux.
A statically-linked, stripped Go ELF backdoor implant providing multi-method persistence (cron job executing /.img, systemd service linux.service from /boot, and SELinux policy manipulation via audit2allow/semodule). Strings indicate additional capabilities including HTTP/2, SSH client, WebSockets, staging/downloader behavior, and host reconnaissance.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.